General
- Target bot.exe
- Size 14.5MB
- Sample260823-pe99sswfnd
- SHA256 3cdb264c1d7605e82979e18f34243dbebf7840487699b93bb69245123941a506
- MD5 75b20c5c255bb6fb29ae916ac2e20f76
- SHA1 5d15c9ccf058c018fdb5507231977824bd3c0c65
- SHA512 5a4dbb0c3a8979623994f2f2766369c053e7d7e5af0167d14701041532a55ce83da3c8f0b864ab19aac002d318715238ea97f4f6f3811e25db46d936688b5fe2
- SSDEEP 393216:HQ7TpXEAphVte510Mj56IOtGjmYgodjPRv/r5WDH:HelRphY10MFHO4jvgod5v/r5Wz
- TLSH T15EE6335CB25050FAF5BA403E4AE6D861F3E232010F62D2DF2BB451542EBB5F46E3DA61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
bot.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
bot.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
bot.pyc
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
bot.pyc
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target bot.exe
- Size 14.5MB
- SHA256 3cdb264c1d7605e82979e18f34243dbebf7840487699b93bb69245123941a506
- MD5 75b20c5c255bb6fb29ae916ac2e20f76
- SHA1 5d15c9ccf058c018fdb5507231977824bd3c0c65
- SHA512 5a4dbb0c3a8979623994f2f2766369c053e7d7e5af0167d14701041532a55ce83da3c8f0b864ab19aac002d318715238ea97f4f6f3811e25db46d936688b5fe2
- SSDEEP 393216:HQ7TpXEAphVte510Mj56IOtGjmYgodjPRv/r5WDH:HelRphY10MFHO4jvgod5v/r5Wz
- TLSH T15EE6335CB25050FAF5BA403E4AE6D861F3E232010F62D2DF2BB451542EBB5F46E3DA61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target bot.pyc
- Size 3KB
- SHA256 0338cd4e4c900b03c7f24388bcb2f5d7a87712a684b948895a8e036c8ace7a0e
- MD5 7e05736745b7753c8fb4b9ee74d18941
- SHA1 0cf2cd9c1e1173af725c175c634d4adf640ee1f7
- SHA512 c9d47d7c6492c634b3c021296e03b550f7fe8a1db422acd28288918505e537a0219dec9f9a4832501ef40bd2440ee35a1d1a5ba4dbb66632b3431ce74a7d1dcc
- TLSH T1AB51B5F2DA959C07CEA6513678D16D66733680A8C509B347D3D84C6D2FC9204A46070E
- MD5 SHA1 SHA512 TLSH
Score3/10